Is $_SERVER[REQUEST_METHOD] manipulable?

Question

In a PHP project I'm developing I have a couple of requests that can be either POST or GET. Currently, I'm using the $_SERVER[REQUEST_METHOD] value to determine, which request array to use. I know that $_REQUEST values can be manipulated with cookies, is the $_SERVER superglobal vulnerable to attacks?

Answer 1

The $_SERVER superglobal is filled by PHP with data it gets from the web server.

So unless the attacker replaces the web server with his own, or manages an extremely lucky buffer overflow against the server, you are fine.

Answer 2

REQUEST_METHOD isn't limited to POST and GET though - you also need to handle HEAD (IIRC PHP will terminate the script at the first sign of output when it sees that header) and (on unlikely setups) you might get a few WebDAV ones.

Answer 3

Thanks for the tip about HEAD. I tested my code and it only accepts GET and POST, all other values are ignored by my code but handled correctly by Apache.

I don't use WebDAV in my app and it isn't supported on the current shared hosting server i use, but i wonder, what issues would that be?

Answer 4

In what sense can $_REQUEST be "manipulated" with cookies? Cookies do override values coming from POST and GET, but all three values are directly controlled by the client making the request.

If you want GET and POST to have priority over cookies, you can set the variable request_order in your php.ini:

request_order = CGP

(which gives post' priority over get' over cookies). You can even leave out C altogether.

Answer 5

@Lamah: That's exactly what i meant, a cookie value can override POST or GET values, manipulated maybe wasn't the right term to use. I was wondering if there's a way to manipulate the $_SERVER array in a similar way.